80bb990332c47e720092bad37a3cfd245336c6fcb44078e1e7920e11b802b54a

General

Target
Mparivahan.apk
Size 11.3MB
Sample260602-apfevahx7x
SHA256 80bb990332c47e720092bad37a3cfd245336c6fcb44078e1e7920e11b802b54a
MD5 227541763887bc717b5c873115eb5344
SHA1 845b91637b1df4b4787fb6810c615d9397523e4b
SHA512 16ddd07f61c14524547d8aca1328dba892e53e9f11e1720b0eef8f6cace9e722de9445be1acc7d7eac3b873ba42209694b0fd951cce97d92026f28c77e00855b
SSDEEP 196608:TLksfE1qFOfol9+C9ovANn5WqY5QUHdhX4tMjm91TFIhEEKnmL7INZvS7c7cA6K9:NfEwFRVo4Nn5XY/HdhX4xFehEZn2MXgo
TLSH
T19DC633ADB131335DD677A23061841DD34E028578BB0E34B1B8A0277E4DDB6F69369B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Mparivahan.apk
- Size 11.3MB
- SHA256 80bb990332c47e720092bad37a3cfd245336c6fcb44078e1e7920e11b802b54a
- MD5 227541763887bc717b5c873115eb5344
- SHA1 845b91637b1df4b4787fb6810c615d9397523e4b
- SHA512 16ddd07f61c14524547d8aca1328dba892e53e9f11e1720b0eef8f6cace9e722de9445be1acc7d7eac3b873ba42209694b0fd951cce97d92026f28c77e00855b
- SSDEEP 196608:TLksfE1qFOfol9+C9ovANn5WqY5QUHdhX4tMjm91TFIhEEKnmL7INZvS7c7cA6K9:NfEwFRVo4Nn5XY/HdhX4xFehEZn2MXgo
- TLSH
  T19DC633ADB131335DD677A23061841DD34E028578BB0E34B1B8A0277E4DDB6F69369B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Requests allowing to install additional applications from unknown sources.
  defense_evasion
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Subvert Trust Controls

2

T1632

Code Signing Policy Modification

2

T1632.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped Dex/Jar

Checks the application is allowed to request package installs through the package installer

Contacts third-party web service commonly abused for C2

Requests allowing to install additional applications from unknown sources.

MITRE ATT&CK Enterprise v16

MITRE ATT&CK Mobile v16

Tasks

static1

behavioral1

behavioral2

behavioral3